# How to parse different time formats

**URL:** <https://discuss.elastic.co/t/how-to-parse-different-time-formats/85265>\
**Category:** Logstash\
**Created:** [May 10, 2017, 2:37pm UTC](https://discuss.elastic.co/t/how-to-parse-different-time-formats/85265 "2017-05-10T14:37:25Z")\
**Posts on this page:** 6\
**Page:** 1

<div class="post-metadata">

**Author:** ![thorsten1](https://avatars.discourse-cdn.com/v4/letter/t/b9e5f3/32.png) [@thorsten1](https://discuss.elastic.co/u/thorsten1)\
**Post date:** [May 10, 2017, 2:37pm UTC](https://discuss.elastic.co/t/how-to-parse-different-time-formats/85265/1 "2017-05-10T14:37:25Z")

</div>

Hello,

I use a file input with a multiline codec and a pattern that says if the line starts with a date then it is a new line.

```
input {
    file {
    ...
    codec => multiline {
    pattern => "^%{MONTH}%{SPACE}%{MONTHDAY},%{SPACE}%{YEAR}?"
    negate => true
    what => previous

```

I also use a grok filter that extract the data from the date:

```
grok {
    match => { 
      "message" => "^%{MONTH:Month}%{SPACE}%{MONTHDAY:Day},%{SPACE}%{YEAR:Year}

```

This works only for dates in the format May 10, 2017 2:35:30 PM  
But I have also dates in the format 2017-05-10 2:35:30 PM.

How can I include both in one config file?

---

<div class="post-metadata">

**Author:** ![theuntergeek](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/theuntergeek/32/44961_2.png) [@theuntergeek](https://discuss.elastic.co/u/theuntergeek)\
**Post date:** [May 10, 2017, 3:01pm UTC](https://discuss.elastic.co/t/how-to-parse-different-time-formats/85265/2 "2017-05-10T15:01:59Z")

</div>

You can combine both on _one line!_[grok allows for an array of patterns](https://www.elastic.co/guide/en/logstash/current/plugins-filters-grok.html#plugins-filters-grok-match), as one possible solution:

```auto
match => {
  "message" => ["%{PATTERN1}", "%{PATTERN2}"]
}

```

Where `%{PATTERN1}` could be your entire `"^%{MONTH:Month}%{SPACE}%{MONTHDAY:Day},%{SPACE}%{YEAR:Year}`, and `%{PATTERN2}` could be the other date pattern.

With multiple fields, the first match wins and suspends further matching. With that understanding, you should put the most common pattern first (e.g. if pattern1 occurs 70% of the time, and pattern2 the other 30%, then put pattern1 as the first pattern in the array).

---

<div class="post-metadata">

**Author:** ![thorsten1](https://avatars.discourse-cdn.com/v4/letter/t/b9e5f3/32.png) [@thorsten1](https://discuss.elastic.co/u/thorsten1)\
**Post date:** [May 11, 2017, 8:21am UTC](https://discuss.elastic.co/t/how-to-parse-different-time-formats/85265/3 "2017-05-11T08:21:40Z")

</div>

Thank you for your answer. It works really fine inside the grok filter.  
But is it also possible for the multiline pattern in the file input?

---

<div class="post-metadata">

**Author:** ![theuntergeek](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/theuntergeek/32/44961_2.png) [@theuntergeek](https://discuss.elastic.co/u/theuntergeek)\
**Post date:** [May 11, 2017, 1:22pm UTC](https://discuss.elastic.co/t/how-to-parse-different-time-formats/85265/4 "2017-05-11T13:22:06Z")

</div>

You'd have to do some fancy work with `(?:` and `|` to make that work, effectively becoming an `OR` clause.

---

<div class="post-metadata">

**Author:** ![thorsten1](https://avatars.discourse-cdn.com/v4/letter/t/b9e5f3/32.png) [@thorsten1](https://discuss.elastic.co/u/thorsten1)\
**Post date:** [May 11, 2017, 1:43pm UTC](https://discuss.elastic.co/t/how-to-parse-different-time-formats/85265/5 "2017-05-11T13:43:38Z")

</div>

Yes thank you. That works fine 🙂

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [June 8, 2017, 1:52pm UTC](https://discuss.elastic.co/t/how-to-parse-different-time-formats/85265/6 "2017-06-08T13:52:24Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.